Share via

Question on TLS 1.2 Enforcement Deadline (31-Aug) and Azure WAF Upgrade

Nang Shwe Yea Oo 20 Reputation points
2025-08-28T08:28:53.9566667+00:00

Hi Community,

We are currently preparing to upgrade our Azure Web Application Firewall (WAF) from V1 to V2 and transition all connections to TLS 1.2 in line with Microsoft’s enforcement deadline of 31 August. I would like to clarify a few points:

  1. What happens if TLS 1.0/1.1 connections are still in use after the 31 August deadline? Will Azure block these immediately?
  2. If we are unable to complete the TLS 1.2 transition by 31 August, can we still upgrade our WAF and enable TLS 1.2 after the deadline, or will there be restrictions?
  3. If the upgrade happens after the deadline, will services resume normal operation once TLS 1.2 is enabled, or are there additional remediation steps?
  4. Are there any known issues/risks with migrating from WAF V1 → V2 specifically related to the TLS 1.2 enforcement?

Any official documentation or guidance would be greatly appreciated.

Thanks in advance,

Shwe Yea

Azure Web Application Firewall
Answer accepted by question author
  1. Pranitha Maddi 1,195 Reputation points Microsoft External Staff Moderator
    2025-08-28T08:59:01.3833333+00:00

    Hi Nang Shwe Yea Oo,

    Thank you for your question on the Microsoft Q&A portal.

    We understand you are planning to upgrade from WAF V1 to WAF V2 and want to ensure a smooth transition in line with Microsoft's TLS 1.2 enforcement deadline on August 31. You're also seeking clarity on how to handle TLS 1.0/1.1 traffic, upgrade timing, and any risks involved in the process.

    Below are detailed answers to your concerns:

    1.What happens if TLS 1.0/1.1 connections are still in use after 31 August?

    • Microsoft will enforce TLS 1.2 or higher for Azure services including WAF.
    • Connections using TLS 1.0 or 1.1 will be blocked or dropped, so it is essential to prepare your clients and backends to support TLS 1.2 or newer.

    2.Can you upgrade the WAF after the deadline if the TLS 1.2 transition is not complete?

    • Yes, you can still upgrade the WAF from V1 to V2 after the deadline.
    • However, connections using TLS versions below 1.2 will not be allowed once enforcement is active, so clients must comply to connect successfully.

    3.Will services resume normal operation after upgrading to WAF V2 with TLS 1.2 enabled post-deadline?

    • After upgrading and enabling TLS 1.2 support, services will function normally as long as clients use supported TLS versions.
    • No additional remediation steps are usually required beyond ensuring TLS compliance.

    4.Known issues or risks migrating WAF V1 → V2 related to TLS 1.2 enforcement:

    • WAF V2 supports autoscaling, zone redundancy, and improved throughput. Migration requires planning but does not intrinsically cause TLS issues.
    • Ensure backend pools and clients are all compatible with TLS 1.2 to avoid connection failures.
    • Review custom WAF rules as rule behavior could vary slightly between V1 and V2.

    Recommended migration steps:

    • Plan and start migration early to avoid last-minute issues.
    • Use the Azure PowerShell migration script specifically built to copy configuration from WAF V1 to WAF V2:
      https://free.blessedness.top/en-us/azure/application-gateway/migrate-v1-v2
    • Validate the new WAF V2 configuration in a test environment before cutover.
    • Perform DNS update or Traffic Manager based traffic shift as described in the migration documentation for smooth cutover.
    • Monitor logs and alerts closely post-migration for any TLS or WAF rule related errors.

    Useful Documents:

    To comply with Microsoft's TLS 1.2 enforcement deadline, ensure clients and backends support TLS 1.2+ before August 31, or connections will be blocked. You can upgrade WAF V1 to V2 anytime; the critical point is ensuring TLS compliance to maintain connectivity. Use Microsoft’s migration tools and documentation to plan and execute the upgrade with minimal disruption.

    I hope this helps you resolve the issue. If you have any further quires, I am happy to assist

    Thank you.

    Pranitha

    1 person found this answer helpful.
    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Nang Shwe Yea Oo 20 Reputation points
    2025-09-03T07:49:25.5266667+00:00

    Hi Pranitha,

    Apologies for the late reply.

    Yes, your previous response was very helpful. Thank you for your support.

    Best regards,

    Shwe Yea

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.